CVE-2010-0657: Google Chrome

High severity, CVSS 9.3. EPSS: 1.9% chance of exploitation in the next 30 days.

Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.

Affected products

• Google Chrome: version 0.2.149.27 only; version 0.2.149.29 only; version 0.2.149.30 only; version 0.2.152.1 only; version 0.2.153.1 only; version 0.3.154.0 only; …

Published 2010-02-18. Last modified 2026-06-16.